-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| heroku-env | npm | <= 0.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability documentation explicitly states the injection point is in lib/get.js, which is required by index.js. The PoC shows the root function (exported from lib/get.js) being called with untrusted input containing shell metacharacters. This matches the command injection pattern where unsanitized input flows into system commands. The function's role in parsing environment variables and interfacing with CLI tools like pg_dump/psql makes it a natural location for command construction without proper escaping.
Ongoing coverage of React2Shell